[citrix_adc] Support addition log message types and ECS mappings

[mjwolf]

Proposed commit message

Improve Citrix ADC integration log parsing and ECS mappings.

Changes are:

• Support "Mapped Ip" as value for Nat_Ip in all patterns in the sslvpn pipeline
• Add support for additional "Message" subtypes, and add a "DATA" wildcard that will capture all patterns. All valid "Message" patterns are not known, so it's better to capture all without parsing individual fields than to cause an error.
• Add addition ECS mappings for event.kind, event.outcome, observer.hostname
• Calculate event.duration as the difference from event.start and event.end

Checklist

• [x] I have reviewed tips for building integrations and this pull request is aligned with them.
• [x] I have verified that all data streams collect metrics or logs.
• [x] I have added an entry to my package's changelog.yml file.
• [x] I have verified that Kibana version constraints are current according to guidelines.
• [ ] I have verified that any added dashboard complies with Kibana's Dashboard good practices

[elasticmachine]

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)

[elastic-vault-github-plugin-prod[bot]]

:rocket: Benchmarks report

To see the full report comment with /test benchmark fullreport

[elastic-sonarqube[bot]]

Quality Gate failed

Failed conditions
78.4% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube

[elasticmachine]

:green_heart: Build Succeeded

• Buildkite Build
• Commit: b54b5d2817f53729988e1b9bee51153e6ae24c29

History

• :green_heart: Build #18471 succeeded e61db7ebe66fe6d9a227474b84c491eece2427db

cc @mjwolf

[elastic-vault-github-plugin-prod[bot]]

Package citrix_adc - 1.12.0 containing this change is available at https://epr.elastic.co/package/citrix_adc/1.12.0/